none
File on a Server 2008 R2 share remains in use for appr. 20 secs after being closed

    Question

  • Hello.

    One of our processes is performed by different computers:

    Computer 1 creates a file and sends a message to computer 2

    Computer 2 reads and processes the file and sends a return code to computer 1

    Computer 1 deletes the file when the return code means success.

    This mechanism is working without problems for many years. But with the introduction of Server 2008 R2 (not Server 2008) problems begun. If the file is created on a 2008 R2 share, deletion of the file fails with ERROR_SHARING_VIOLATION. Only after a delay of appr. 20 seconds computer 1 is able to delete the file.

    I have been able to reproduce this behaviour using this code:

    Computer 1 creates the file:

    DWORD CreateFile ( LPCTSTR Filename )
    {
      HANDLE h = CreateFile ( Filename, GENERIC_WRITE, FILE_SHARE_READ, NULL,
                              CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL );
      if ( h == INVALID_HANDLE_VALUE )
         { return GetLastError ( ); }
     
      DWORD nBytes;
      DWORD Erc = 0;
      if ( !WriteFile ( h, "TEST", 4, &nBytes, NULL ))
         { Erc = GetLastError ( ); }
     
      if ( !CloseHandle ( h ))
         { if ( Erc == 0 )
              { Erc = GetLastError ( ); } }
               
      return Erc; }

    After that, Computer 1 (the same computer) reads the file.

    DWORD ReadFile ( LPCTSTR Filename )
    {
      HANDLE h = CreateFile ( Filename, GENERIC_READ, FILE_SHARE_READ, NULL,
                              OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL );
      if ( h == INVALID_HANDLE_VALUE )
         { return GetLastError ( ); }
     
      char Buf[MAX_PATH];
      DWORD nBytes;
      DWORD Erc = 0;
      if ( !ReadFile ( h, Buf, sizeof ( Buf ), &nBytes, NULL ))
         { Erc = GetLastError ( ); }
     
      if ( Erc == 0 )
         { Buf[nBytes] = 0;
           MessageBox ( NULL, "Press OK to continue ...", Buf, MB_OK ); }

      if ( !CloseHandle ( h ))
         { if ( Erc == 0 )
              { Erc = GetLastError ( ); } }
               
      return Erc; }

    The message box is displayed for checking if everything is fine up till now. It is. Now computer 2 gets the signal and deletes the file:

    void Test ( ClientType * Client )
    {
      DWORD Attempt = 0;
      DWORD Erc = 0;
     
      do { if ( DeleteFile ( Client->Msg->Info ))
              { Erc = 0; } else
              { Erc = GetLastError ( );
                if ( Erc == ERROR_SHARING_VIOLATION )
                   { Attempt++;
                     Sleep ( 100 ); } }
         } while ( Erc == ERROR_SHARING_VIOLATION && Attempt < 300 );
     
      char Msg[200] = "OK";
      if ( Erc != 0 )
         { wsprintf ( Msg, "Errorcode: %d", Erc ); }
        
      if ( Erc == 0 && Attempt > 0 )
         { Attempt++;
           wsprintf ( Msg, "OK. Number of attempts: %d.", Attempt ); }
     
      SendReply ( Client, Erc, Msg, FALSE ); }

    It takes an average of 20 attempts before computer 2 is able to delete the file, but it takes more than 20 seconds. It seems DeleteFile has a 1-second delay, too.

    To make it even more strange, the 20 attempts delay occurs when computer 1 is running Windows 7 and computer 2 is running Windowe XP Professional. If computer1 is running XP and computer 2 is running Windows 7, no delay occurs.

    Does somebody know how we can get the "Server 2003" behaviour back? Is there some registry setting in R2?

     

    Thanks in advance.

    Marcel Kuiper

    Wednesday, August 24, 2011 10:29 AM

All replies

  • Please post in the MSDN forums for more help

    http://social.msdn.microsoft.com/forums/en-US/categories/


    http://www.virmansec.com/blogs/skhairuddin
    Wednesday, August 24, 2011 11:09 AM
  • Thank you, Syed, for replying. But it is not a development problem, it can be reproduced by Windows explorer and notepad as well.

    Here is how to reproduce without programming:

    Assume 3 computers.

    Computer 1, Server 2008 R2 (x64) with a share, let's call it \\W2008R2\Share Everybody has read/write access.

    Computer 2, W7 (x64)

    Computer 3, XP Prof. (x86)

    - Both computer 2 and 3, start Explorer and navigate to \\W2008R2\Share

    - Computer2: With Explorer, create a new text document and open it with notepad.

    - Computer3: You can see the document appearing in Explorer

    - Computer2: Close notepad

    - Computer3: Delete the document immediately after computer2 has closed it. This will not succeed if done within appr. 20 seconds.

    Wednesday, August 24, 2011 12:01 PM
  • I would look for other processes getting ahold of the file, on the surface I would point to the guilty finger at an anti-virus real time scanner, the behavior seems to fit what you are seeing.
    :P Advice offered, If you need more help it is advised to seek the council and advice of paid professionals. The answer is always 42, or reboot.
    Wednesday, August 24, 2011 1:25 PM
  • Excellent suggestion, Jason, but unfortunately not working.

    All the virusscanners are disabled now but the behaviour is still the same.

     

    Wednesday, August 24, 2011 3:05 PM
  • Hi,

     

    During test via Windows Explorer and notepad, did you receive any error when deleting the file? You can collect the Network Monitor trace when the issue is reproduced. Refer to:

     

    Download Network Monitor

    http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=983b941d-06cb-4658-b7f6-3088333d062f  

     

    For more information about network monitor, please refer to the following KB article.

     

    How to Capture Network Traffic with Network Monitor

    http://support.microsoft.com/?id=148942  

     

    Thanks.

    Nina


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Monday, August 29, 2011 8:22 AM
    Moderator
  • Hi,

    here they come (filtered Property.SMBFileName.contains("nieuw").

    W7 (Create the file using Explorer, open it with notepad and close it immediately):

    375 14:52:03 30-8-2011 15.4428182 System MARCELK_W7   10.200.17.30 SMB2 SMB2:C   CREATE (0x5), Sh(RWD), DHnQ+MxAc+QFid, File=SGConfiguratie\Sync\Nieuw tekstdocument.txt@#375   {SMB2:147, SMBOverTCP:140, TCP:139, IPv4:138}
    376 14:52:03 30-8-2011 15.4432169 System 10.200.17.30 MARCELK_W7   SMB2 SMB2:R  - NT Status: System - Error, Code = (52) STATUS_OBJECT_NAME_NOT_FOUND  CREATE (0x5) , File=SGConfiguratie\Sync\Nieuw tekstdocument.txt@#375  {SMB2:147, SMBOverTCP:140, TCP:139, IPv4:138}
    377 14:52:03 30-8-2011 15.4435717 System MARCELK_W7   10.200.17.30 SMB2 SMB2:C   CREATE (0x5), Sh(None), DHnQ+MxAc+QFid+RqLs(RHW), File=SGConfiguratie\Sync\Nieuw tekstdocument.txt@#377   {SMB2:148, SMBOverTCP:140, TCP:139, IPv4:138}
    378 14:52:03 30-8-2011 15.4444866 System 10.200.17.30 MARCELK_W7   SMB2 SMB2:R   CREATE (0x5), MxAc+RqLs(RHW)+DHnQ+QFid, FID=0xFFFFFFFF00000025(SGConfiguratie\Sync\Nieuw tekstdocument.txt@#377)  {SMB2:148, SMBOverTCP:140, TCP:139, IPv4:138}
    497 14:52:05 30-8-2011 17.5037966 System MARCELK_W7   10.200.17.30 SMB2 SMB2:C   CLOSE (0x6), FID=0xFFFFFFFF00000025(SGConfiguratie\Sync\Nieuw tekstdocument.txt@#377)   {SMB2:148, SMBOverTCP:140, TCP:139, IPv4:138}
    498 14:52:05 30-8-2011 17.5042498 System 10.200.17.30 MARCELK_W7   SMB2 SMB2:R   CLOSE (0x6), File=SGConfiguratie\Sync\Nieuw tekstdocument.txt@#377   {SMB2:148, SMBOverTCP:140, TCP:139, IPv4:138}
    499 14:52:05 30-8-2011 17.5043814 System MARCELK_W7   10.200.17.30 SMB2 SMB2:C   CREATE (0x5), Sh(RW), DHnQ+MxAc+RqLs(RHW), File=SGConfiguratie\Sync\Nieuw tekstdocument.txt@#499   {SMB2:180, SMBOverTCP:140, TCP:139, IPv4:138}
    501 14:52:05 30-8-2011 17.5050895 System 10.200.17.30 MARCELK_W7   SMB2 SMB2:R   CREATE (0x5), MxAc+RqLs(RHW)+DHnQ, FID=0xFFFFFFFF00000049(SGConfiguratie\Sync\Nieuw tekstdocument.txt@#499)  {SMB2:180, SMBOverTCP:140, TCP:139, IPv4:138}
    503 14:52:05 30-8-2011 17.5419277 System 10.200.17.30 MARCELK_W7   SMB2 SMB2:R   CREATE (0x5), MxAc, FID=0xFFFFFFFF0000004D(SGConfiguratie\Sync\Nieuw tekstdocument.txt@#502)  {SMB2:181, SMBOverTCP:140, TCP:139, IPv4:138}
    504 14:52:05 30-8-2011 17.5431391 System MARCELK_W7   10.200.17.30 SMB2 SMB2:C   QUERY INFORMATION (0x10), Class=Query FS Object Id Info, FID=0xFFFFFFFF0000004D(SGConfiguratie\Sync\Nieuw tekstdocument.txt@#502)   {SMB2:181, SMBOverTCP:140, TCP:139, IPv4:138}
    505 14:52:05 30-8-2011 17.5435495 System 10.200.17.30 MARCELK_W7   SMB2 SMB2:R   QUERY INFORMATION (0x10), File=SGConfiguratie\Sync\Nieuw tekstdocument.txt@#502   {SMB2:181, SMBOverTCP:140, TCP:139, IPv4:138}
    510 14:52:05 30-8-2011 17.5463305 System MARCELK_W7   10.200.17.30 SMB2 SMB2:C   CLOSE (0x6), FID=0xFFFFFFFF0000004D(SGConfiguratie\Sync\Nieuw tekstdocument.txt@#502)   {SMB2:181, SMBOverTCP:140, TCP:139, IPv4:138}
    511 14:52:05 30-8-2011 17.5466976 System 10.200.17.30 MARCELK_W7   SMB2 SMB2:R   CLOSE (0x6), File=SGConfiguratie\Sync\Nieuw tekstdocument.txt@#502   {SMB2:181, SMBOverTCP:140, TCP:139, IPv4:138}
    776 14:52:18 30-8-2011 31.0778919 System MARCELK_W7   10.200.17.30 SMB2 SMB2:C   CLOSE (0x6), FID=0xFFFFFFFF00000049(SGConfiguratie\Sync\Nieuw tekstdocument.txt@#499)   {SMB2:180, SMBOverTCP:140, TCP:139, IPv4:138}
    777 14:52:18 30-8-2011 31.0885656 System 10.200.17.30 MARCELK_W7   SMB2 SMB2:R   CLOSE (0x6), File=SGConfiguratie\Sync\Nieuw tekstdocument.txt@#499   {SMB2:180, SMBOverTCP:140, TCP:139, IPv4:138}

     

    XP (Try to delete the file - fails with "file in use" message, succeeds after appr. 20 seconds)

    457 14:52:09 30-8-2011 16.3953253 System 10.200.2.181 10.200.17.30 SMB SMB:C; Nt Create Andx, FileName = \SGConfiguratie\Sync\Nieuw tekstdocument.txt {SMB:170, NbtSS:82, TCP:81, IPv4:80}
    474 14:52:10 30-8-2011 17.3982543 System 10.200.17.30 10.200.2.181 SMB SMB:R; Nt Create Andx - NT Status: System - Error, Code = (67) STATUS_SHARING_VIOLATION {SMB:170, NbtSS:82, TCP:81, IPv4:80}
    654 14:52:17 30-8-2011 23.7058723 System 10.200.2.181 10.200.17.30 SMB SMB:C; Nt Create Andx, FileName = \SGConfiguratie\Sync\Nieuw tekstdocument.txt {SMB:225, NbtSS:82, TCP:81, IPv4:80}
    655 14:52:17 30-8-2011 23.7058723 System 10.200.17.30 10.200.2.181 SMB SMB:R; Nt Create Andx, FID = 0x8000 (\SGConfiguratie\Sync\Nieuw tekstdocument.txt@#654) {SMB:225, NbtSS:82, TCP:81, IPv4:80}
    656 14:52:17 30-8-2011 23.7058723 System 10.200.2.181 10.200.17.30 SMB SMB:C; Transact2, Query File Info, Query File Internal Info, FID = 0x8000 (\SGConfiguratie\Sync\Nieuw tekstdocument.txt@#654) {SMB:225, NbtSS:82, TCP:81, IPv4:80}
    657 14:52:17 30-8-2011 23.7068483 System 10.200.17.30 10.200.2.181 SMB SMB:R; Transact2, Query File Info, Query File Internal Info, FID = 0x8000 (\SGConfiguratie\Sync\Nieuw tekstdocument.txt@#654) {SMB:225, NbtSS:82, TCP:81, IPv4:80}
    658 14:52:17 30-8-2011 23.7088013 System 10.200.2.181 10.200.17.30 SMB SMB:C; Transact2, Set File Info, Set File Disposition Info, FID = 0x8000 (\SGConfiguratie\Sync\Nieuw tekstdocument.txt@#654) {SMB:225, NbtSS:82, TCP:81, IPv4:80}
    659 14:52:17 30-8-2011 23.7097783 System 10.200.17.30 10.200.2.181 SMB SMB:R; Transact2, Set File Info, Set File Disposition Info, FID = 0x8000 (\SGConfiguratie\Sync\Nieuw tekstdocument.txt@#654) {SMB:225, NbtSS:82, TCP:81, IPv4:80}
    660 14:52:17 30-8-2011 23.7097783 System 10.200.2.181 10.200.17.30 SMB SMB:C; Close, FID = 0x8000 , FileName=\SGConfiguratie\Sync\Nieuw tekstdocument.txt@#654  {SMB:225, NbtSS:82, TCP:81, IPv4:80}
    661 14:52:17 30-8-2011 23.7107543 System 10.200.17.30 10.200.2.181 SMB SMB:R; Close, FID = 0x8000 , FileName=\SGConfiguratie\Sync\Nieuw tekstdocument.txt@#654  {SMB:225, NbtSS:82, TCP:81, IPv4:80}

     

    Regards, Marcel

    Tuesday, August 30, 2011 1:09 PM
  • It seems SMB2.1 is the cause of the problem.

    The problem exists only if the share is on a SMB2.1 server (W7/2008 R2) and accessed by a SMB2.1 (W7/2008 R2) client.

    Disabling SMB2 on either the server or the client solves the problem. But in my opinion I should only do that if no other workarounds are available.

    This page describes some client settings for SMB2: http://technet.microsoft.com/en-us/library/ff686200(WS.10).aspx

    I have tried all three registry settings mentioned but no luck. The only success so far is by turning off SMB2 completely.

    I think I am looking for a setting which turns off the oplock-enhancements in SMB2.1. Is there anybody who knows of this kind of registry setting?


    Monday, September 05, 2011 10:57 AM
  • Just chiming in here that it looks like I'm observing the same or a very similar problem.

    Server is 2008 R2.  Clients are a mix of XP (x32) and 7 (x64).

    While performing file operations in Explorer, users will sometimes be told that a file is in use and cannot be deleted/moved.  It can take more than 30 seconds for the file handle to free up.

    Logging out and back in again immediately frees up the handle and the operation is allowed.

     

    I don't want to turn off SMB2, as it seems to have some real benefits, but it looks I'll be forced to for the sake of stability.

     

    Friday, September 30, 2011 8:59 PM